41 ms·

it's 2021. updating apps should not be something every developer has to write themselves. it should be part of the operating system, separate from the app store

by joshu 6y ago

it's 2021. updating apps should not be something every developer has to write themselves. it should be part of the operating system, separate from the app stores...

jeffchien 6y ago
I'm not entirely sure what you mean by "part of operating system, separate from the app stores", but in this case a server was delivering tainted updates, so having an OS-based update mechanism/package manager by itself wouldn't have prevented this. Unless you also mean that this update should have gone through the OS's repositories (which I feel is close to app store).
gchamonlive 6y ago
A quick search showed compromised packages in arch aur repos: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/ https://www.bleepingcomputer.com/news/security/malware-found... You only change the focal point, but a centralised package manager is good for reasons other than security. Sure, a central tool will keep your whole system updated and improve security overall, but it won't prevent supply-chain attacks from happening. Reading mailing lists and being careful with what you install will take you a long way in preventing malware.
- sergeykish 6y ago
  I trust packages that comes from official repositories. > Warning: AUR packages are user produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk. In other words AUR is not much safer than `curl to | sh`.
  - gchamonlive 6y ago
    Sure, but it is centralised in the os distribution package manager, if you use helpers like yay. I am just pointing out that centralisation is not solution to the attack mentioned.
  - NullPrefix 6y ago
    I assume AUR includes hashes, which could at least hint to deterministic builds. `curl to | sh` can change from build to build and there's no way to find out from which source other users built.
privacyking 6y ago
This is one of the biggest advantages of linux.
- belltaco 6y ago
  Security by obscurity? https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/ https://www.bleepingcomputer.com/news/security/malware-found... Imagine how many more attacks there would be if Linux was much more popular.
  - nomad41 6y ago
    The AUR isn't officially supported by Arch, it's just a collection of community scripts. In fact "AUR helpers" aren't present in Arch repos.
  - Daho0n 6y ago
    It is only used in ~80% of some of the most valuable targets on the internet, the servers, and it is only by far the most used operating system with more than 50% compared to the huge target that is the ~15% that is Windows. Security by obscurity is more fitting for Windows than Linux. Imagine how many more attacks there would be if Windows was much more popular. Windows in on par with iOS. Stop being a troll. https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
    - belltaco 6y ago
      >it is only by far the most used operating system with more than 50% So you're counting Android as Linux, that means Linux has a big malware problem right? Or do you only count Android to pad Linux's numbers and then discount Android malware? Servers are managed by relatively much more tech savvy folks who install programs carefully. Not so much on PCs that aren't locked down like iOS, and where there is developer freedom. iOS is only more secure than Windows at the cost of developer freedom, sad to see people on a techie site praise iOS and insult Windows based on that.
  - 6y ago
pjmlp 6y ago
It is, but then you come to places like HN and everyone is bashing against App Stores.
numpad0 6y ago
The problem lies in Unix/Windows style app packaging, or lack thereof in Unix as originally conceived. /etc, /usr, and so on.

by joshu 6y ago

it's 2021. updating apps should not be something every developer has to write themselves. it should be part of the operating system, separate from the app stores...

jeffchien 6y ago

I'm not entirely sure what you mean by "part of operating system, separate from the app stores", but in this case a server was delivering tainted updates, so having an OS-based update mechanism/package manager by itself wouldn't have prevented this. Unless you also mean that this update should have gone through the OS's repositories (which I feel is close to app store).

gchamonlive 6y ago

A quick search showed compromised packages in arch aur repos: https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/ https://www.bleepingcomputer.com/news/security/malware-found... You only change the focal point, but a centralised package manager is good for reasons other than security. Sure, a central tool will keep your whole system updated and improve security overall, but it won't prevent supply-chain attacks from happening. Reading mailing lists and being careful with what you install will take you a long way in preventing malware.

sergeykish 6y ago
I trust packages that comes from official repositories. > Warning: AUR packages are user produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk. In other words AUR is not much safer than `curl to | sh`.
- gchamonlive 6y ago
  Sure, but it is centralised in the os distribution package manager, if you use helpers like yay. I am just pointing out that centralisation is not solution to the attack mentioned.
- NullPrefix 6y ago
  I assume AUR includes hashes, which could at least hint to deterministic builds. `curl to | sh` can change from build to build and there's no way to find out from which source other users built.

privacyking 6y ago

This is one of the biggest advantages of linux.

belltaco 6y ago
Security by obscurity? https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/ https://www.bleepingcomputer.com/news/security/malware-found... Imagine how many more attacks there would be if Linux was much more popular.
- nomad41 6y ago
  The AUR isn't officially supported by Arch, it's just a collection of community scripts. In fact "AUR helpers" aren't present in Arch repos.
- Daho0n 6y ago
  It is only used in ~80% of some of the most valuable targets on the internet, the servers, and it is only by far the most used operating system with more than 50% compared to the huge target that is the ~15% that is Windows. Security by obscurity is more fitting for Windows than Linux. Imagine how many more attacks there would be if Windows was much more popular. Windows in on par with iOS. Stop being a troll. https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
  - belltaco 6y ago
    >it is only by far the most used operating system with more than 50% So you're counting Android as Linux, that means Linux has a big malware problem right? Or do you only count Android to pad Linux's numbers and then discount Android malware? Servers are managed by relatively much more tech savvy folks who install programs carefully. Not so much on PCs that aren't locked down like iOS, and where there is developer freedom. iOS is only more secure than Windows at the cost of developer freedom, sad to see people on a techie site praise iOS and insult Windows based on that.
- 6y ago

pjmlp 6y ago

It is, but then you come to places like HN and everyone is bashing against App Stores.

numpad0 6y ago

The problem lies in Unix/Windows style app packaging, or lack thereof in Unix as originally conceived. /etc, /usr, and so on.